---
title: SIP Registration with Authentication - Excerpt from ECGT2010 - ECG
description: A Walk Through a SIP Registration SIP Registrations can look different on different systems. But when you're reading through the packet capture or logs,
---
[](https://www.ecg.co)
- Who We Are
Company
[**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers)
Industries We Serve
[**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers)
- Technologies
**Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect
**Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling
**Unified Communications & Collaboration** UC capabilities & platform expertise
**Platform Reliability & Security** Infrastructure, capture & network fundamentals
### Carrier & Trunking Services
Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording.
[SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording)
### Compliance & Call Authentication
Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling.
[STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp)
### Unified Communications & Collaboration
Modern UC capabilities backed by deep, hands-on expertise across every major voice platform.
[E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations)
Platform Expertise
[BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller)
### Platform Reliability & Security
The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day.
[EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing)
- How We Do It
Services
[**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering)
- Resources
#### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator)
#### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library)
#### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog)
- [Events](https://www.ecg.co/events)
[Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact)
Who We Are
[About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers)
Industries We Serve
[Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers)
Technologies
Carrier & Trunking Services
[SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording)
Compliance & Call Authentication
[STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp)
Unified Communications & Collaboration
[E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations)
Platform Expertise
[BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller)
Platform Reliability & Security
[EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing)
How We Do It
Services
[Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering)
Resources
[Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog)
[Events](https://www.ecg.co/events)
[Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact)
# SIP Registration with Authentication - Excerpt from ECGT2010 Training
By: Mark Lindsey
3 min read
Jul 1, 2020
## A Walk Through a SIP Registration
SIP Registrations can look different on different systems. But when you're reading through the packet capture or logs, reading SIP messaging, it's important to may attention to the direction the packets are flowing. Some people assume they can easily read the SIP message itself to see which device sent it, but it's actually not that easy. You really need to look at the source and destination IP addresses of the packets.
## Step 1: First SIP Register Message - from Phone (SIP Endpoint) to SBC
The phone will transmit a SIP "REGISTER" message to the SBC. It sends to the untrusted or customer-facing interface on the SBC. SBCs typically have at least one Untrusted interface, and one Trusted-network interface. (In a Zero-Trust SIP Environment, you may have only a single interface that uses different TLS certificates to identify itself with the rest of the network.)
The From and To headers in the SIP REGISTER have the SIP Address of Record. This is the user Identity.
The Contact header in a SIP REGISTER specifies where messages should be sent in order to reach that user. For eample, in this registration for Corey Lewis, user sip:9197400628@vwave.net, the Contact header indicates that Corey Lewis can be contacted by transmitting a SIP message to 192.168.200.89 port 5060/udp.
## Step 2: REGISTER message from SBC to core Registrar
The SBC then sends a SIP REGISTER to the core regisrar. Because the SBC is the SIP path to reach the user, the SBC will modify the Contact header. The new Contact header causes the core SIP registrar to record the location of the user as being on the SBC.
After a successful registration, all of the SIP traffic from the core servers in the network will flow to the user through the SBC. So the user can, in effect, be reached by sending SIP to the SBC.
## Step 3: Core Registrar sends a SIP 401 response to the SBC
The SBC sends a 401 response from the SBC. This 401 is a type of failure: it means, in essence, that the core registrar cannot trust the REGISTER. It hasn't determined yet that the SIP REGISTER was transmitted by a device that authentically represents the user.
The 401 response includes a WWW-Authenticate header, which includes enough a nonce. This can be used by a legitimate phone to REGISTER again and prove its identity.
## Step 4: SBC sends 401 response to the phone
The SBC sends the 401 SIP response through to the phone. If the phone is behind a NAT device, then the SBC would use the nat-traversal methods.
## Step 5: Phone sends a new SIP REGISTER to the SBC including an Authorization header
The Phone computes a response based on the nonce and the SIP authentication password and includes that in the Authorization header. If the phone has the proper password, then it will be able to compute a response that matches the one that the core server has computed.
This MD5 method for SIP authentication is not quantum-safe, so we expect to see other options in the future. There are some vulnerabilities in MD5, but they don't affect this particular use case.
## Step 6: The SBC sends the REGISTER with Authorization to the Core Regstrar
The SBC makes only small changes in the REGISTER sent to the Core Registrar, such as modifying the Contact as above. This REGISTER has the Authorization header that was computed by the phone.
## Step 7: The SIP Core Registrar checks the registration and returns SIP 200 OK
Once the SIP Core Registrar computes proper response value, it can check it against the value provided by the SIP REGISTER. If they match, then the Registrar has proven that the phone has the same password.
The expiration time provided by the SIP Core Registrar determines when the endpoint device must re-register. In the example shown, the registration must be refreshed within an hour -- or just shy of it, 3,599 seconds.
## Step 8: The SBC sends the 200 OK to the phone
The SBC now knows that the user is successfully registered. It may modify the Registration expiration time to force the SIP phone to re-register frequently. This is commonly used as a keepalive mechanism for NAT devices or firewall pinholes.
## Example Environment
This particular example was taken from a Cisco BroadWorks system, Oracle Communications Session Border Controller, and Polycom SoundPoint IP SIP phone.
*Join us live in ECGT2010 to discuss and ask your questions about SIP calling. This live training with Q&A is perfect to get the key information you need to understand VoIP / UCaaS calling.*
[Course Details and Registration](https://www.ecg.co/training/2-voice-and-video-call-control-troubleshooting)
[training](https://www.ecg.co/blog/tag/training) [sip](https://www.ecg.co/blog/tag/sip) [certification](https://www.ecg.co/blog/tag/certification) [register](https://www.ecg.co/blog/tag/register)
## Similar posts
[](https://www.ecg.co/blog/111-broadsoft-broadworks-database-server-dbs-cheat-sheet)
### [BroadSoft BroadWorks Database Server (DBS) - Cheat Sheet](https://www.ecg.co/blog/111-broadsoft-broadworks-database-server-dbs-cheat-sheet)
[](https://www.ecg.co/blog/144-sip-forum-s-virtual-shaken-stir-summit)
### [SIP Forum's Virtual SHAKEN/STIR Summit](https://www.ecg.co/blog/144-sip-forum-s-virtual-shaken-stir-summit)
[](https://www.ecg.co/blog/81-if-iphone-development-was-complete-the-apple-store-wouldn-t-have-avaya-phones)
### [If iPhone development was complete, the Apple Store wouldn't have](https://www.ecg.co/blog/81-if-iphone-development-was-complete-the-apple-store-wouldn-t-have-avaya-phones)
## Need Help With Your Network or AI Project?
Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies.
[Let's Talk](https://www.ecg.co/contact)
[](https://www.ecg.co/)
505 North Toombs St. Suite A
Valdosta, Georgia 31601 USA
#### Headquarters
- 1.866.324.0700 US Toll-free
- 1.229.244.2099 International
- 1.229.244.2399 Fax
- [info@e-c-group.com](mailto:info@e-c-group.com)
#### Services
- [Overview](https://www.ecg.co/services)
- [Network Operations](https://www.ecg.co/services/network-operations)
- [Custom AI Development](https://www.ecg.co/services/custom-ai-development)
- [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support)
- [Staff Augmentation](https://www.ecg.co/services/staff-augmentation)
- [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering)
#### Company
- [About](https://www.ecg.co/about)
- [Careers](https://www.ecg.co/careers)
- [Blog](https://www.ecg.co/blog)
- [Resources](https://www.ecg.co/resource-library)
- [Events](https://www.ecg.co/events)
© ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Mark Lindsey",
"url" : "https://www.ecg.co/blog/author/mark-lindsey"
},
"dateModified" : "2025-03-31T08:39:54.153Z",
"datePublished" : "2020-07-01T04:00:00.000Z",
"headline" : "SIP Registration with Authentication - Excerpt from ECGT2010 - ECG",
"mainEntityOfPage" : {
"@id" : "https://www.ecg.co/blog/146-sip-registration-with-authentication-excerpt-from-ecgt2010-training",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg"
},
"name" : "ECG, Inc"
}
}
```